"Disable Javascript" option removed in Firefox 23 • Hacker News Board

Re: "Disable Javascript" option removed in Firefox 23

#351

Post by SomeoneElsa » Mon, Jul 01, 2013, 8:58 PM UTC

Someone wrote: post #326

just2n wrote: post #169

Earlier quoted context omitted.

I have to say that this article is actually quite terrible, as is the opinion that any option that might ever be confusing to a user is an option that shouldn't ship with the product. The thesis of the article is: "Well, we have met the enemy, and he is us.* In the currently shipping version, Firefox ships with many options that will render the browser unusable to most people, right in the main settings ui." The solu…

I am not planning on implementing that, but let's pretend I want to. When would that dialog come up? Attempt #1: show that dialog as soon as a page tries to load some JavaScript. Result (I'm guessing): dialog shows up on 99.9% of all web pages one visits (even for the nerdiest of nerds) Attempt #2: silently download the JavaScript to figure out whether it is 'benign' or 'evil'. Result: users complain that they pay fo…

Understand that no dialog is necessary for such an idea to be implemented at all.

Observe:

  
    The webpage you are viewing may 
    not work correctly because the following 
    options differ from their default values:

    1. Enable automatic loading of images. 
    2. Enable JavaScript.

    These features of Firefox are essential 
    for most webpages to run properly. If the 
    webpage you are trying to access is behaving 
    strangely or appears to be working incorrectly, 
    click here to load the page 
    with the default browser configuration.

Re: "Disable Javascript" option removed in Firefox 23

#352

Post by asadotzler » Mon, Jul 01, 2013, 9:28 PM UTC

homeomorphic wrote: post #250

njr123 wrote: post #51

Earlier quoted context omitted.

Have you ever actually met any normal users? They have work they need to do, and the software is just a means to an end. They don't want to be 'empowered' by developers, and they definitely don't want to have to deal with arranging a bunch of poorly documented modules that make no sense if you are not familiar with the underlying architecture.

Then have another checkbox, something like " enable advanced settings (warning: if you don't know anything about cars, would you really mess with your car's breaks?) ", that toggles the availability of these kinds of settings. Everybody wins.

We have that. It's called about:config.

Re: "Disable Javascript" option removed in Firefox 23

#353

Post by tracker1 » Mon, Jul 01, 2013, 10:23 PM UTC

Amadou wrote: post #196

tracker1 wrote: post #157

Earlier quoted context omitted.

[body] [noscript]This site requires cookies and javascript to function properly[/noscript] ... [/body] Problem solved.

Not for cookies it ain't.

You do your test for cookies in JS, and display the message about cookies alone if that test fails.

Re: "Disable Javascript" option removed in Firefox 23

#354

Post by karaziox » Mon, Jul 01, 2013, 10:35 PM UTC

gnosis wrote: post #333

driverdan wrote: post #330

Earlier quoted context omitted.

TL;DR: Get off my lawn. HN demonstrates good use of JS: AJAX voting. Forcing you to navigate to another page in order to vote is slow, annoying, and disruptive. Plenty of sites make good use of JS. For those who don't use NoScript.

Since I've switched mostly to a browser that doesn't support Javascript, I've stopped voting on HN. Not voting is also a good way to avoid being tracked and pigeonholed. It's true that if everybody did that, this site would be a lot less useful. However, I'm not convinced that some sort of anonymous yet secure and transparent voting system can't be implemented. But, while voting requires enabling technolgy that will…

The Internet is a technology helping others track and pigeonhole you. Will you stop using it? And telephone? And everything? Seriously, everything can be "corrupted" to be used against you...

Re: "Disable Javascript" option removed in Firefox 23

#355

Post by Groxx » Mon, Jul 01, 2013, 11:07 PM UTC

gnosis wrote: post #335

Groxx wrote: post #329

Earlier quoted context omitted.

So you're not OK with giving a site a fairly narrow range of sandboxed permissions, but you are OK with installing an opaque binary that can read, modify, transmit, and destroy nearly every piece of your data on your computer.

Who said anything about it having to be a binary? You have heard of open source software that doesn't need a browser to run, haven't you?

Sure. Do you personally read through every line of source? Maybe you trust the repository managers to do so, and limit yourself to only very-popular projects - do you completely trust the trust-chain that lets them submit new code? Maybe you do - remember when RubyGems.org was hacked? Or when [many sites] lost their private crypto keys? What's to stop the same thing from happening, and pushing a critical update with an exploit? Maybe you reduce the frequency you check for updates to mitigate this kind of vulnerability - oops, now you're more vulnerable to new exploits.

If you're not watching every step, every time, you're gambling the same way you're gambling with malicious code in a browser (though I'll admit it's lower frequency). Your privacy/security is in the hands of whoever is part of the chain you trust, and their security practices, completely aside from new exploits that could affect you directly. Open Source, binary, it's all the same in the end unless you're perfect in your observational skills. Sandboxing limits that trust. I'll even grant that it's technically possible to do the same thing with processes in Unix, which you could be doing - but it's hard, error-prone, and essentially nobody does it except the stragglers who haven't switched to virtualization (which is essentially sandboxing).

You're being paranoid. With perfectly justifiable reasons - everything you listed is possible, plausible, and related things have actually happened. But you're not applying the paranoia evenly.

Re: "Disable Javascript" option removed in Firefox 23

#356

Post by hysan » Mon, Jul 01, 2013, 11:10 PM UTC

jwarren wrote: post #260

hysan wrote: post #219

Earlier quoted context omitted.

While you may know a lot of people who do VBA code in Excel, that is actually far from the norm for the average corporate user. From my non-CS friends who have worked in both large and small companies, I have heard tons of horror stories of the insane spreadsheets that low-to-average users make using just the GUI functionality. Huge spreadsheets with formulas spanning tons of sheets to simulate what could be done in…

My dad takes great pride in complex VBA code. Unfortunately, this can backfire. A few years ago he was brought in to help manage a particular support system for a large telecoms company here in the UK, which involved a lot of Excel donkey work. He understandably figured out a way to automate about 50% of the work of the entire system. This meant that he freed up plenty of time for the entire team he was on. Unfortuna…

100% believe you because this was one of the concerns my friend had about sharing her work. Only management didn't go the firing route. They ended up giving the employees even more work because of their newly found free time.

Re: "Disable Javascript" option removed in Firefox 23

#357

Post by pessimizer » Mon, Jul 01, 2013, 11:37 PM UTC

jrochkind1 wrote: post #328

pessimizer wrote: post #309

Earlier quoted context omitted.

>If people don't know the difference between diesel and gasoline, is a note that says "Note: Diesel is not the same as Gasoline" going to help? Doubt it. Really? I would think that sign would help everyone who knew how to read, bothered to read, and wanted their car to run. A sign with a simple message like that was enough to fix one national timeclock system that I worked on. "Do not do X before 12:00 Noon unless Y.…

If they don't know the difference between diesel and gasoline, how do they know if the one they want is "diesel" or "gasoline"? But, yes, clearly, the goal is removing configuration until the app does one thing well, not badly.

Only if you want 9000 apps, because then it becomes a question of which of those super narrowly focused apps will work to do what you want to do. An email client that only emails your mother is a good emailing your mother client, but a bad email client. If they take away configuration for people with stepmothers or two mothers, because it's only a 5% use case, it's even a bad emailing your mother client.

If you know your car runs on gasoline, and you don't know the difference between gasoline and diesel, then you see a sign that says "diesel is not gasoline," you know that diesel is not what you're looking for - even though you still don't know the difference.

Re: "Disable Javascript" option removed in Firefox 23

#358

Post by millstone » Tue, Jul 02, 2013, 12:06 AM UTC

Kequc wrote: post #294

millstone wrote: post #227

Earlier quoted context omitted.

"Do you want to disable JavaScript?" is a stupid question, as you say. "Do you want your browser to tell Google, Facebook, Twitter, Omniture, DoubleClick, and six other companies you have never heard of, that you visited this site?" is not a dumb question. Given that option, 98% of users would say "hell no." You are absolutely right that configurability is a sign of laziness, the opposite of hard work. But removing c…

Sending browsing statistics to something like Google is already happening regardless of if you have Javascript enabled. When you are on Google search and you click on a link it's tracked that you went to that link. But besides that and besides that your usage statistics are being logged on the server itself regardless of what you do. Expecting Mozilla or any company to figure out how to block a javascript put request…

> When you are on Google search and you click on a link it's tracked that you went to that link.

Google also tracks the links I click when I am on CNN, ABC News, Fox News, MSN, LinkedIn, and the majority of sites I visit (with the important exceptions of Wikipedia and BBC News - thanks guys!). Advertisers track me when I am not even on their properties! That is what is objectionable, and what is defeated by disabling JavaScript.

> Expecting Mozilla or any company to figure out how to block a javascript put request sent to Facebook, but not other put requests which are there by design of the site will only result in Facebook finding a workaround.

Perhaps, but Mozilla should do it anyways.

Remember the ruckus over IE 10 enabling Do Not Track by default? Advertisers and ad brokers were “very concerned”[1] by even the whiff of a browser maker acting in the interest of users over advertisers. Do Not Track is only tolerable if it is off by default, wholly unenforceable, and just as buried as the “Enable JavaScript” option.

Make no mistake: advertisers believe that they have a right to know what links you click and sites you visit across the whole web, and even a right to enlist your browser to aid in informing them. And Mozilla is complicit!

(And why not? Recall who pays Mozilla’s bills.)

> These days Javascript is as much a part of websites as the HTML itself.

Yes, which means that those few who disable JavaScript pay a significant price for that decision. Nobody disables JavaScript because they hate the language. They do it to escape user-hostile JavaScript programs.

[1] http://www.businesswire.com/news/home/20120531006914/en/Digi...

Re: "Disable Javascript" option removed in Firefox 23

#359

Post by joeheyming » Tue, Jul 02, 2013, 1:27 AM UTC

Maybe Firefox can replace it with a don't tender html checkbox

Re: "Disable Javascript" option removed in Firefox 23

#360

Post by exodust » Tue, Jul 02, 2013, 2:51 PM UTC

dthunt wrote: post #302

exodust wrote: post #278

Earlier quoted context omitted.

> "failure to handle disabled js gracefully." How are we meant to handle AJAX requests that fetch data to display on the web page that allows users to achieve the goal of their visit? Without JS enabled, that part of the page will be blank, and many modern, rich content-heavy sites now pull data from different places on the fly, it's just how it is. Is your idea of gracefully handling this situation putting a noscrip…

Let's not forget that not every page is meant for humans to read, and not every reader is attempting to consume information the same high-bandwidth (visual) way. You might think AJAX is amazing, but I call it an accessibility nightmare.

I know exactly what you mean by AJAX being an accessibility nightmare, and perhaps my own recent over-indulgence in using AJAX to populate the website I made will come back to bite. Time will tell, and I'm willing to eat humble pie over it. But in my defense the client's requirement was to get that content on the page, and AJAX was the only method available to me.